-------------------------------------------------------------------

Mon Jan 29 22:32:21 UTC 2018 - wr@rosenauer.org

- update to Firefox 58.0.1

  MFSA 2018-05

  *  Arbitrary code execution through unsanitized browser UI (bmo#1432966)

- readd mozilla-enable-csd.patch as it only lands for FF59 upstream

- allow larger number of nested elements (mozilla-bmo256180.patch)

-------------------------------------------------------------------

Tue Jan 23 20:40:57 UTC 2018 - wr@rosenauer.org

- update to Firefox 58.0 (bsc#1077291)

  * Added Nepali (ne-NP) locale

  * Added support for form autofill for credit card

  * Optimize page load by caching JavaScript internal representation

  MFSA 2018-02

  * CVE-2018-5091 (bmo#1423086)

    Use-after-free with DTMF timers

  * CVE-2018-5092 (bmo#1418074)

    Use-after-free in Web Workers

  * CVE-2018-5093 (bmo#1415291)

    Buffer overflow in WebAssembly during Memory/Table resizing

  * CVE-2018-5094 (bmo#1415883)

    Buffer overflow in WebAssembly with garbage collection on

    uninitialized memory

  * CVE-2018-5095 (bmo#1418447)

    Integer overflow in Skia library during edge builder allocation

  * CVE-2018-5097 (bmo#1387427)

    Use-after-free when source document is manipulated during XSLT

  * CVE-2018-5098 (bmo#1399400)

    Use-after-free while manipulating form input elements

  * CVE-2018-5099 (bmo#1416878)

    Use-after-free with widget listener

  * CVE-2018-5100 (bmo#1417405)

    Use-after-free when IsPotentiallyScrollable arguments are freed

    from memory

  * CVE-2018-5101 (bmo#1417661)

    Use-after-free with floating first-letter style elements

  * CVE-2018-5102 (bmo#1419363)

    Use-after-free in HTML media elements

  * CVE-2018-5103 (bmo#1423159)

    Use-after-free during mouse event handling

  * CVE-2018-5104 (bmo#1425000)

    Use-after-free during font face manipulation

  * CVE-2018-5105 (bmo#1390882)

    WebExtensions can save and execute files on local file system

    without user prompts

  * CVE-2018-5106 (bmo#1408708)

    Developer Tools can expose style editor information cross-origin

    through service worker

  * CVE-2018-5107 (bmo#1379276)

    Printing process will follow symlinks for local file access

  * CVE-2018-5108 (bmo#1421099)

    Manually entered blob URL can be accessed by subsequent private browsing tabs

  * CVE-2018-5109 (bmo#1405599)

    Audio capture prompts and starts with incorrect origin attribution

  * CVE-2018-5110 (bmo#1423275) (affects only OS X)

    Cursor can be made invisible on OS X

  * CVE-2018-5111 (bmo#1321619)

    URL spoofing in addressbar through drag and drop

  * CVE-2018-5112 (bmo#1425224)

    Extension development tools panel can open a non-relative URL in the panel

  * CVE-2018-5113 (bmo#1425267)

    WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow

  * CVE-2018-5114 (bmo#1421324)

    The old value of a cookie changed to HttpOnly remains accessible to scripts

  * CVE-2018-5115 (bmo#1409449)

    Background network requests can open HTTP authentication in unrelated foreground tabs

  * CVE-2018-5116 (bmo#1396399)

    WebExtension ActiveTab permission allows cross-origin frame content access

  * CVE-2018-5117 (bmo#1395508)

    URL spoofing with right-to-left text aligned left-to-right

  * CVE-2018-5118 (bmo#1420049)

    Activity Stream images can attempt to load local content through file:

  * CVE-2018-5119 (bmo#1420507)

    Reader view will load cross-origin content in violation of CORS headers

  * CVE-2018-5121 (bmo#1402368) (affects only OS X)

    OS X Tibetan characters render incompletely in the addressbar

  * CVE-2018-5122 (bmo#1413841)

    Potential integer overflow in DoCrypt

  * CVE-2018-5090

    Memory safety bugs fixed in Firefox 58

  * CVE-2018-5089

    Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6

- requires NSS 3.34.1

- requires rust 1.21

- removed obsolete patches:

  mozilla-bindgen-systemlibs.patch

  mozilla-bmo1360278.patch

  mozilla-bmo1399611-csd.patch

  mozilla-rust-1.23.patch

- rebased patches

- updated man-page

-------------------------------------------------------------------

Tue Jan  9 18:48:02 UTC 2018 - wr@rosenauer.org

- fixed build with latest rust (mozilla-rust-1.23.patch)

-------------------------------------------------------------------

Thu Jan  4 12:23:41 UTC 2018 - wr@rosenauer.org

- update to Firefox 57.0.4

  MFSA 2018-1: Speculative execution side-channel attack ("Spectre")

  (boo#1074723)

-------------------------------------------------------------------

Wed Jan  3 08:29:38 UTC 2018 - wr@rosenauer.org

- fixed regression introduced Oct 10th which made Firefox crash

  when cancelling the KDE file dialog (boo#1069962)

-------------------------------------------------------------------

Fri Dec 29 19:52:34 UTC 2017 - astieger@suse.com

- Mozilla Firefox 57.0.3:

  * Fix a crash reporting issue that inadvertently sends background

    tab crash reports to Mozilla without user opt-in (bmo#1427111,

    bsc#1074235)

- Includes changes from 57.0.2:

  * fixes for platforms other than GNU/Linux

-------------------------------------------------------------------

Fri Dec  8 15:52:17 UTC 2017 - dimstar@opensuse.org

- Explicitly buildrequires python2-xml: The build system relies on

  it. We wrongly relied on other packages pulling it in for us.

-------------------------------------------------------------------

Thu Dec  7 11:12:31 UTC 2017 - dimstar@opensuse.org

- Escape the usage of %{VERSION} when calling out to rpm.

  RPM 4.14 has %{VERSION} defined as 'the main packages version'.

-------------------------------------------------------------------

Wed Nov 29 23:45:03 UTC 2017 - wr@rosenauer.org

- update to Firefox 57.0.1

  * CVE-2017-7843: Web worker in Private Browsing mode can write

    IndexedDB data (bsc#1072034, bmo#1410106)

  * CVE-2017-7844: Visited history information leak through SVG

    image (bsc#1072036, bmo#1420001)

  * Fix a video color distortion issue on YouTube and other video

    sites with some AMD devices (bmo#1417442)

  * Fix an issue with prefs.js when the profile path has non-ascii

    characters (bmo#1420427)

-------------------------------------------------------------------

Tue Nov 21 09:00:48 UTC 2017 - christophe@krop.fr

- Add mozilla-bmo1360278.patch

  Starting with Firefox 57, the context menu appears on key press.

  This patch creates a config entry to restore the

  old behaviour. Without the patch, the mouse gesture extensions

  require 2 clicks to work (bmo#1360278).

  The new config entry is named ui.context_menus.after_mouseup

  (default : false).

-------------------------------------------------------------------

Sat Nov 18 08:35:21 UTC 2017 - wr@rosenauer.org

- Allow experimental CSD for Gtk3 (bmo#1399611) if available and enabled

  widget.allow-client-side-decoration=true

  (mozilla-bmo1399611-csd.patch)

-------------------------------------------------------------------

Wed Nov 15 06:46:06 UTC 2017 - wr@rosenauer.org

- update to Firefox 57.0 (boo#1068101)

  * Firefox Quantum

  * Photon UI

  * Unified address and search bar

  * AMD VP9 hardware video decoder support

  * Added support for Date/Time input

  * stricter security sandbox blocking filesystem reading and

    writing on Linux systems

  * middle mouse paste in the content area no longer navigates to

    URLs by default on Unix systems

  MFSA 2017-24

  * CVE-2017-7828 (bmo#1406750. bmo#1412252)

    Use-after-free of PressShell while restyling layout

  * CVE-2017-7830 (bmo#1408990)

    Cross-origin URL information leak through Resource Timing API

  * CVE-2017-7831 (bmo#1392026)

    Information disclosure of exposed properties on JavaScript proxy

    objects

  * CVE-2017-7832 (bmo#1408782)

    Domain spoofing through use of dotless 'i' character followed

    by accent markers

  * CVE-2017-7833 (bmo#1370497)

    Domain spoofing with Arabic and Indic vowel marker characters

  * CVE-2017-7834 (bmo#1358009)

    data: URLs opened in new tabs bypass CSP protections

  * CVE-2017-7835 (bmo#1402363)

    Mixed content blocking incorrectly applies with redirects

  * CVE-2017-7836 (bmo#1401339)

    Pingsender dynamically loads libcurl on Linux and OS X

  * CVE-2017-7837 (bmo#1325923)

    SVG loaded as <img> can use meta tags to set cookies

  * CVE-2017-7838 (bmo#1399540)

    Failure of individual decoding of labels in international domain

    names triggers punycode display of entire IDN

  * CVE-2017-7839 (bmo#1402896)

    Control characters before javascript: URLs defeats self-XSS

    prevention mechanism

  * CVE-2017-7840 (bmo#1366420)

    Exported bookmarks do not strip script elements from user-supplied

    tags

  * CVE-2017-7842 (bmo#1397064)

    Referrer Policy is not always respected for <link> elements

  * CVE-2017-7827

    Memory safety bugs fixed in Firefox 57

  * CVE-2017-7826

    Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

- requires NSPR 4.17, NSS 3.33 and rustc 1.19

- rebased patches

- added mozilla-bindgen-systemlibs.patch to allow stylo build

  with system libs (bmo#1341234)

- removed mozilla-language.patch since the whole locale code

  changed in Firefox and is relying on ICU now

- removed obsolete mozilla-ucontext.patch

-------------------------------------------------------------------

Sat Oct 28 06:30:37 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0.2

  * Disable Form Autofill completely on user request (bmo#1404531)

  * Fix for video-related crashes on Windows 7 (bmo#1409141)

  * Correct detection for 64-bit GSSAPI authentication (bmo#1409275)

  * Fix for shutdown crash (bmo#1404105)

-------------------------------------------------------------------

Tue Oct 10 11:47:49 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0.1

  * Block D3D11 when using Intel drivers on Windows 7 systems with

    partial AVX support (bmo#1403353)

  -> just to sync the version number

- enable stylo for TW (requires LLVM >= 3.9)

- queue KDE filepicker requests to avoid non-opening file dialogs

  happening in certain situations (contributed by Ignaz Forster)

- the placeholder dot in KDE file dialog in case of empty filenames

  was removed, apparently not required (anymore)

  (contributed by Ignaz Forster)

-------------------------------------------------------------------

Sun Oct  1 18:25:16 UTC 2017 - stefan.bruens@rwth-aachen.de

- Correct plugin directory for aarch64 (boo#1061207). The wrapper

  script was not detecting aarch64 as a 64 bit architecture, thus

  used /usr/lib/browser-plugins/.

-------------------------------------------------------------------

Sat Sep 30 20:10:50 UTC 2017 - zaitor@opensuse.org

- Drop libgnomeui-devel, and replace it with pkgconfig(gconf-2.0),

  pkgconfig(gtk+-2.0), pkgconfig(gtk+-unix-print-2.0),

  pkgconfig(glib-2.0), pkgconfig(gobject-2.0) and

  pkgconfig(gdk-x11-2.0) BuildRequires, align with what configure

  looks for.

-------------------------------------------------------------------

Thu Sep 28 08:28:29 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0 (boo#1060445)

  * Firefox Screenshots

  * Find Options/Preferences more quickly with new search function

  * Media is no longer auto-played when opened in a background tab

  * Enable CSS Grid Layout View

  MFSA 2017-21

  * CVE-2017-7793 (bmo#1371889)

    Use-after-free with Fetch API

  * CVE-2017-7817 (bmo#1356596) (Android-only)

    Firefox for Android address bar spoofing through fullscreen mode

  * CVE-2017-7818 (bmo#1363723)

    Use-after-free during ARIA array manipulation

  * CVE-2017-7819 (bmo#1380292)

    Use-after-free while resizing images in design mode

  * CVE-2017-7824 (bmo#1398381)

    Buffer overflow when drawing and validating elements with ANGLE

  * CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement)

    Use-after-free in TLS 1.2 generating handshake hashes

  * CVE-2017-7812 (bmo#1379842)

    Drag and drop of malicious page content to the tab bar can open locally stored files

  * CVE-2017-7814 (bmo#1376036)

    Blob and data URLs bypass phishing and malware protection warnings

  * CVE-2017-7813 (bmo#1383951)

    Integer truncation in the JavaScript parser

  * CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only)

    OS X fonts render some Tibetan and Arabic unicode characters as spaces

  * CVE-2017-7815 (bmo#1368981)

    Spoofing attack with modal dialogs on non-e10s installations

  * CVE-2017-7816 (bmo#1380597)

    WebExtensions can load about: URLs in extension UI

  * CVE-2017-7821 (bmo#1346515)

    WebExtensions can download and open non-executable files without user interaction

  * CVE-2017-7823 (bmo#1396320)

    CSP sandbox directive did not create a unique origin

  * CVE-2017-7822 (bmo#1368859)

    WebCrypto allows AES-GCM with 0-length IV

  * CVE-2017-7820 (bmo#1378207)

    Xray wrapper bypass with new tab and web console

  * CVE-2017-7811

    Memory safety bugs fixed in Firefox 56

  * CVE-2017-7810

    Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

- requires NSPR 4.16 and NSS 3.32.1

- rebased patches

-------------------------------------------------------------------

Thu Sep 28 07:53:13 UTC 2017 - dimstar@opensuse.org

- Add alsa-devel BuildRequires: we care for ALSA support to be

  built and thus need to ensure we get the dependencies in place.

  In the past, alsa-devel was pulled in by accident: we

  buildrequire libgnome-devel. This required esound-devel and that

  in turn pulled in alsa-devel for us. libgnome is being fixed to

  no longer require esound-devel.

-------------------------------------------------------------------

Mon Sep  4 18:27:44 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0.3

  * Fix an issue with addons when using a path containing non-ascii

    characters (bmo#1389160)

  * Fix file uploads to some websites, including YouTube (bmo#1383518)

- fix Google API key build integration

- add mozilla-ucontext.patch to fix Tumbleweed build

- do not enable XINPUT2 for now (boo#1053959)

-------------------------------------------------------------------

Fri Aug 11 08:32:30 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0.1

  * Fix a regression the tab restoration process (bmo#1388160)

  * Fix a problem causing What's new pages not to be displayed (bmo#1386224)

  * Fix a rendering issue with some PKCS#11 libraries (bmo#1388370)

  * Disable the predictor prefetch (bmo#1388160)

-------------------------------------------------------------------

Sat Aug  5 13:22:16 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0 (boo#1052829)

  * Browsing sessions with a high number of tabs are now restored

    in an instant

  * Sidebar (bookmarks, history, synced tabs) can now be moved to

    the right edge of the window

  * Fine-tune your browser performance from the Preferences/Options page.

  * Make screenshots of webpages, and save them locally or upload

    them to the cloud. This feature will undergo A/B testing and

    will not be visible for some users.

  * Added Belarusian (be) locale

  * Simplify print jobs from within print preview

  * Use virtual reality devices with the web with the introduction

    of WebVR

  * Search suggestions are now enabled by default for users who

    haven't explicitly opted-out

  * Search with any installed search engine directly from the

    location bar

  * IMPORTANT: Breaking profile changes - do not downgrade Firefox

    and use a profile that has been opened with Firefox 55+.

  * The Adobe Flash plugin is now click-to-activate by default and

    only allowed on http:// and https:// URL schemes. This change

    will be rolled out progressively and so will not be visible to

    all users immediately. For more information see the Firefox

    plugin roadmap

  * Modernized application update UI to be less intrusive and more

    aligned with the rest of the browser. Only users who have not

    restarted their browser 8 days after downloading an update or

    users who opted out of automatic updates will see this change.

  * Insecure sites can no longer access the Geolocation APIs to get

    access to your physical location

  * requires NSPR 4.15 and NSS 3.31

  MFSA 2017-18

  * CVE-2017-7798 (bmo#1371586, bmo#1372112)

    XUL injection in the style editor in devtools

  * CVE-2017-7800 (bmo#1374047)

    Use-after-free in WebSockets during disconnection

  * CVE-2017-7801 (bmo#1371259)

    Use-after-free with marquee during window resizing

  * CVE-2017-7809 (bmo#1380284)

    Use-after-free while deleting attached editor DOM node

  * CVE-2017-7784 (bmo#1376087)

    Use-after-free with image observers

  * CVE-2017-7802 (bmo#1378147)

    Use-after-free resizing image elements

  * CVE-2017-7785 (bmo#1356985)

    Buffer overflow manipulating ARIA attributes in DOM

  * CVE-2017-7786 (bmo#1365189)

    Buffer overflow while painting non-displayable SVG

  * CVE-2017-7806 (bmo#1378113)

    Use-after-free in layer manager with SVG

  * CVE-2017-7753 (bmo#1353312)

    Out-of-bounds read with cached style data and pseudo-elements#

  * CVE-2017-7787 (bmo#1322896)

    Same-origin policy bypass with iframes through page reloads

  * CVE-2017-7807 (bmo#1376459)

    Domain hijacking through AppCache fallback

  * CVE-2017-7792 (bmo#1368652)

    Buffer overflow viewing certificates with an extremely long OID

  * CVE-2017-7804 (bmo#1372849)

    Memory protection bypass through WindowsDllDetourPatcher

  * CVE-2017-7791 (bmo#1365875)

    Spoofing following page navigation with data: protocol and modal alerts

  * CVE-2017-7808 (bmo#1367531)

    CSP information leak with frame-ancestors containing paths

  * CVE-2017-7782 (bmo#1344034)

    WindowsDllDetourPatcher allocates memory without DEP protections

  * CVE-2017-7781 (bmo#1352039)

    Elliptic curve point addition error when using mixed Jacobian-affine coordinates

  * CVE-2017-7794 (bmo#1374281)

    Linux file truncation via sandbox broker

  * CVE-2017-7803 (bmo#1377426)

    CSP containing 'sandbox' improperly applied

  * CVE-2017-7799 (bmo#1372509)

    Self-XSS XUL injection in about:webrtc

  * CVE-2017-7783 (bmo#1360842)

    DOS attack through long username in URL

  * CVE-2017-7788 (bmo#1073952)

    Sandboxed about:srcdoc iframes do not inherit CSP directives

  * CVE-2017-7789 (bmo#1074642)

    Failure to enable HSTS when two STS headers are sent for a connection

  * CVE-2017-7790 (bmo#1350460) (Windows-only)

    Windows crash reporter reads extra memory for some non-null-terminated registry values

  * CVE-2017-7796 (bmo#1234401) (Windows-only)

    Windows updater can delete any file named update.log

  * CVE-2017-7797 (bmo#1334776)

    Response header name interning leaks across origins

  * CVE-2017-7780

    Memory safety bugs fixed in Firefox 55

  * CVE-2017-7779

    Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3

- updated mozilla-kde.patch:

  * removed "downloadfinished" alert as Firefox reimplemented the

    whole thing (TODO: check if there is another function we should

    hook in)

-------------------------------------------------------------------

Tue Jul  4 20:08:47 UTC 2017 - wr@rosenauer.org

- update to Firefox 54.0.1

  * Fix a display issue of tab title (bmo#1357656)

  * Fix a display issue of opening new tab (bmo#1371995)

  * Fix a display issue when opening multiple tabs (bmo#1371962)

  * Fix a tab display issue when downloading files (bmo#1373109)

  * Fix a PDF printing issue (bmo#1366744)

  * Fix a Netflix issue on Linux (bmo#1375708)

-------------------------------------------------------------------

Thu Jun 15 13:56:05 UTC 2017 - wr@rosenauer.org

- update to Firefox 54.0

  * Clearer and more detailed information for download items in the

    download panel

  * Added Burmese (my) locale

  * Bookmarks created on mobile devices are now shown in

    "Mobile Bookmarks” folder in the drop down list from the toolbar

    and Bookmarks option in the menu bar in Desktop Firefox

  * added support for multiple content processes (e10s-multi)

- requires NSPR 4.14 and NSS 3.30.2

- requires rust 1.15.1

- removed mozilla-shared-nss-db.patch as it seems to be a rather

  unused feature

-------------------------------------------------------------------

Thu Jun  1 04:25:05 UTC 2017 - kah0922@gmail.com

- remove -fno-inline-small-functions and explicitely optimize with

  -O2 for openSUSE > 13.2/Leap 42 to work with gcc7 (boo#1040105)

-------------------------------------------------------------------

Wed Apr 26 12:37:38 UTC 2017 - wr@rosenauer.org

- switch to Mozilla's geolocation service (boo#1026989)

- removed mozilla-preferences.patch obsoleted by overriding via

  firefox.js

- fixed KDE integration to avoid crash caused by filepicker

  (boo#1015998)

-------------------------------------------------------------------

Mon Apr 17 12:52:10 UTC 2017 - wr@rosenauer.org

- update to Firefox 53.0